> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudeg.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FraudEG Device Intelligence: Fingerprinting and Bots

> Use FraudEG device intelligence to detect bots, emulators, and suspicious devices before they complete fraudulent transactions or account takeovers.

Device intelligence is FraudEG's layer of protection that runs before a user ever submits a transaction. By collecting and analyzing device attributes the moment a session begins, FraudEG builds a persistent **device fingerprint** — a stable identifier for the device that persists across sessions even when cookies are cleared. This fingerprint feeds directly into the transaction risk score and surfaces device-level signals that indicate bots, emulators, account takeover tooling, and other automated threats.

## What FraudEG Collects

FraudEG gathers a broad set of device attributes to construct each fingerprint:

| Attribute Category           | Examples                                                                          |
| ---------------------------- | --------------------------------------------------------------------------------- |
| **Browser / app attributes** | User-agent, browser version, installed fonts, canvas rendering, WebGL renderer    |
| **Hardware fingerprint**     | Screen resolution, CPU core count, memory size, touch support                     |
| **IP reputation**            | ISP, ASN, data center detection, known malicious IP ranges                        |
| **Proxy / VPN detection**    | Known VPN exit nodes, datacenter IPs, Tor exit relays                             |
| **Bot signals**              | Headless browser indicators, automation framework artifacts (Selenium, Puppeteer) |
| **Emulator detection**       | Android/iOS emulator artifacts, virtual machine indicators                        |

None of these attributes are personally identifiable on their own. FraudEG combines them into a probabilistic fingerprint that identifies the device without relying on cookies or device IDs that users can easily reset.

## Device Sessions

A **device session** ties a user's device fingerprint to a specific visit on your application. Create a device session at the start of each critical user flow (login, checkout, account settings) and attach the returned `session_id` to your transaction scoring request. This links the device intelligence data collected during the session to the transaction FraudEG scores.

### Creating a Device Session

<CodeGroup>
  ```html JavaScript Snippet (Web) theme={null}
  <script>
    window.FraudEG = window.FraudEG || {};
    window.FraudEG.apiKey = 'feg_test_pk_xxxxxxxxxxxx';
  </script>
  <script src="https://cdn.fraudeg.com/v1/device.js" async></script>
  ```

  ```bash cURL (Session API) theme={null}
  curl -X POST https://api.fraudeg.com/v1/device/session \
    -H "Authorization: Bearer feg_test_sk_xxxxxxxxxxxx" \
    -H "Content-Type: application/json" \
    -d '{
      "page_url": "https://yourapp.com/checkout",
      "user_id": "usr_8f3k2p"
    }'
  ```
</CodeGroup>

After the JavaScript snippet loads, it automatically collects device attributes and posts them to FraudEG. The snippet exposes a `FraudEG.getSessionId()` method you can call client-side to retrieve the `session_id`, which you then pass to your backend to include in transaction scoring requests.

```javascript theme={null}
// After the snippet has loaded
const sessionId = await window.FraudEG.getSessionId();

// Pass sessionId to your backend alongside the transaction
await submitCheckout({ sessionId, cartId: 'cart_xxx' });
```

## Device Trust Score

FraudEG computes a **device trust score** (0–100, where 100 is fully trusted) for each session. This score contributes directly to the overall transaction risk score. A low device trust score elevates the transaction score even if other signals appear normal — for example, a known user logging in from a fresh emulator with a VPN active will see a higher transaction risk score than usual.

## Device Signals

The following device-level signals appear in the `signals` array of transaction responses:

| Signal               | Meaning                                                                                       |
| -------------------- | --------------------------------------------------------------------------------------------- |
| `device_trusted`     | The device has a positive history and matches the user's known device profile.                |
| `new_device`         | FraudEG has not seen this device associated with this user before.                            |
| `bot_detected`       | Headless browser or automation framework artifacts found in the session.                      |
| `emulator_detected`  | The session originated from a software-emulated device environment.                           |
| `vpn_detected`       | The device's IP resolves to a known VPN or proxy service.                                     |
| `ip_datacenter`      | Traffic originates from a cloud or datacenter IP rather than a residential or mobile network. |
| `device_compromised` | The device fingerprint matches a fingerprint previously associated with confirmed fraud.      |

## Web Integration

Place the JavaScript snippet in the `<head>` of every page that precedes a critical user action — login, checkout, account update, and password reset pages are the most important. The snippet is lightweight (\<10 KB gzipped) and loads asynchronously so it does not affect your page load performance.

```html theme={null}
<!DOCTYPE html>
<html>
  <head>
    <title>Checkout</title>
    <!-- FraudEG Device Intelligence -->
    <script>
      window.FraudEG = window.FraudEG || {};
      window.FraudEG.apiKey = 'feg_test_pk_xxxxxxxxxxxx';
    </script>
    <script src="https://cdn.fraudeg.com/v1/device.js" async></script>
  </head>
  <body>
    <!-- your checkout UI -->
  </body>
</html>
```

## Mobile SDK

For native iOS and Android applications, use the FraudEG mobile SDKs instead of the JavaScript snippet. The mobile SDKs collect platform-specific device attributes (hardware identifiers, OS version, jailbreak/root detection) and create device sessions using the same `POST /v1/device/session` API. Contact [FraudEG support](https://fraudeg.com/contact) to request the mobile SDK documentation for your platform.

## Privacy and Data Handling

FraudEG processes device attributes for fraud detection purposes only and does not sell or share device data with third parties. Device fingerprints are stored as cryptographic hashes — the raw attribute values used to build the fingerprint are discarded after processing.

| Regulation | FraudEG Approach                                                                                                                                                           |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **GDPR**   | Device data is processed under legitimate interest for fraud prevention. Data is stored in EU regions for EU-origin traffic. Deletion requests are honored within 30 days. |
| **CCPA**   | FraudEG does not sell personal information. Device attributes are classified as fraud-prevention operational data.                                                         |
| **PSD2**   | Device intelligence contributes to Strong Customer Authentication (SCA) risk analysis under the transaction risk analysis (TRA) exemption.                                 |

<Warning>
  Do not rely on device signals alone to make block decisions. A `vpn_detected` or `new_device` signal on its own does not confirm fraud — many legitimate users browse with VPNs or access your app from a new device. Always combine device signals with behavioral, transactional, and velocity signals through the risk rules engine for accurate, low-false-positive decisioning.
</Warning>